Privacy Policy — Findig AI



Last Updated: October 2026

Thank you for choosing Findig AI ('the App'). Protecting your personal data and privacy is our highest priority. This Privacy Policy explains how Findig AI processes your data, our strict privacy standards, and your rights under global data protection laws (including the EU/UK GDPR, California Consumer Privacy Act / CCPA / CPRA, and COPPA).


1. Data Controller & Contact Information


The entity responsible for the processing of personal data through the App is:

N+B IT GmbH
Moltkestr. 13
58332 Schwelm, Germany
Email: support@nplusb.de
Website: https://www.nplusb.de/


2. Core Architecture: Zero-Login & Local-First



a) No Account Required (Zero-Login)
Findig AI requires no user registration, no account creation, and no login. We do not collect or request your name, email address, phone number, physical address, or password.

b) Local-First On-Device Storage
Findig AI is designed strictly around the principle of Privacy by Design:
• All your chat conversations, uploaded documents, manual notes, and the personal knowledge base reside 100% locally on your smartphone.
• We do not maintain server-side chat logs or sync your private history to any cloud server. Your history stays securely on your device.


3. What Data Is Processed and Why?



a) Pseudonymous Device Identifier (Token Balance Management)
• Data collected: Upon first launch, the App generates a random, cryptographically secure pseudonymous device identifier stored securely on your device.
• Purpose: This identifier is used solely to maintain your consumable token balance (welcome starter tokens and purchased packs) on our backend server and deduct tokens per request. It cannot be linked to your real identity.
• Legal Basis: Performance of a contract / Terms of Service (GDPR Art. 6(1)(b)).

b) Standard Text & Photo Requests (Server Location: Germany)
• Data processed: When you submit a standard query or upload a photo/document for analysis, the text and images are transmitted encrypted to our backend server gateway.
• Server Location & Provider: Our server gateway and the processing of these requests are hosted via cloud services in Germany (Frankfurt am Main).
• Ephemeral Processing & Zero-Training: Your data is processed ephemerally in volatile memory solely to generate the real-time response and is discarded immediately thereafter. Under binding commercial agreements with the cloud provider, your inputs and images are never used to train AI models.
• Legal Basis: GDPR Art. 6(1)(b) (performance of the requested service).

c) Hands-Free Live Voice Mode (Server Location: USA)
• How it works: When using the interactive hands-free voice feature, your spoken words captured by your device microphone are streamed encrypted in real time to Google cloud services to generate spoken answers.
• Server Location USA & International Transfer: Because Google operates this real-time voice infrastructure on servers in the United States, your voice data is transmitted there.
• Privacy Guarantees:
- Ephemeral Processing (Zero-Persistence): Audio streams are processed strictly in-memory in real time and are discarded immediately once the turn is completed. There is no persistent recording or storage of your voice data.
- Zero-Training: Your voice data is not used to train AI models.
- Transfer Safeguards: Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF) (adequacy decision pursuant to GDPR Art. 45). In addition, EU standard contractual clauses (SCCs) are in place pursuant to GDPR Art. 46(2)(c).
• Legal Basis: GDPR Art. 6(1)(b) (performance of the requested live voice service) and GDPR Art. 49(1)(b).

d) Web & Image Search
• Data processed: When the AI searches the web to provide an answer, only the topical search query is transmitted to external search providers (such as Google Search, DuckDuckGo, Bing, or Wikipedia). No personal user data, device IP addresses, or device identifiers are shared with these search providers.
• Purpose: Providing accurate, up-to-date data, guides, and reference images.
• Legal Basis: Legitimate interests (GDPR Art. 6(1)(f)).

e) In-App Purchases (Token Consumables)
• Payment Processing: All purchases of consumable token packages are processed directly through the Apple App Store (Apple Inc.) or Google Play Store (Google LLC). We never collect, process, or store credit card, banking, or billing details.
• Receipt Validation & Fulfillment: To validate purchases and unlock acquired token packages, we utilize a specialized technical service provider for receipt validation (USA) under EU standard contractual clauses (processing solely your pseudonymous device identifier and store transaction IDs).
• Local Balance Management: Because tokens are digital consumables operating without registration or user accounts (Zero-Login), balances are managed locally on your device. No cross-device tracking or user profiling takes place.
• Legal Basis: GDPR Art. 6(1)(b) (performance of contract).

f) App Integrity & Abuse Prevention (Firebase App Check)
• Purpose & Operation: To protect our backend infrastructure against automated denial-of-service (DDoS) attacks, scraping, tampering, and unauthorized third-party clients, the App utilizes the security service Firebase App Check provided by Google Ireland Limited.
• Hardware & OS Attestation: At startup and during server requests, native platform attestation services (Apple App Attest on iOS and Google Play Integrity on Android) cryptographically attest that requests originate from an authentic, unmodified Findig AI app running on a genuine device.
• Data Processed: Ephemeral attestation tokens and device integrity metadata are transmitted to and verified by Google. No advertising or behavioral user profiles are created.
• Legal Basis: Legitimate interests in network and information security (GDPR Art. 6(1)(f) and Recital 49).


4. Device Permissions


The App requests the following device permissions only when required to provide specific features:

• Camera: To photograph parts, devices, screens, or labels for visual diagnosis, and for hands-free voice-directed camera inspection.
• Microphone: For voice input, interactive hands-free voice mode, and acoustic noise diagnostics.
• Photo Library: To import photos or documents via the secure system photo picker into the chat, and to save diagnostic snapshots locally to your photo library.
• Flashlight / Torch: To illuminate dark machinery or workspaces via voice or UI toggle.
• Bluetooth: For audio routing to wireless headsets during hands-free operation.


5. Third-Party Analytics & Advertising


• NO Advertising: Findig AI contains zero advertisements. We do not participate in any ad networks.
• NO Tracking SDKs: We do not embed third-party tracking or behavioral analytics tools (e.g., Google Analytics, Firebase Analytics, Meta SDK, AppsFlyer). We do not track your activity across third-party apps or websites.


6. Data Retention & Deletion Rights


• On-Device Data: You can delete individual chats, your knowledge base, or all application data at any time directly in the App Settings. Deleting the app from your device immediately removes all locally stored data.
• Server-Side Token Records: The pseudonymous device token and remaining balance stored on our server can be verified or deleted upon request by contacting us with your anonymous Support ID (visible in the app under Settings > Management & Data > Anonymous Support ID).


7. Your GDPR Rights (European Union & UK)


Under the GDPR, you have the right to:
• Request access to your personal data (Art. 15 GDPR).
• Request rectification of incorrect data (Art. 16 GDPR).
• Request erasure of your data (Art. 17 GDPR).
• Request restriction of processing (Art. 18 GDPR).
• Request data portability (Art. 20 GDPR) — an offline export feature is available directly in the App.
• Object to data processing (Art. 21 GDPR).
• Lodge a complaint with a competent supervisory data protection authority (Art. 77 GDPR).


8. US State Privacy Disclosures (California / CCPA & CPRA)


Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
• No Sale or Sharing of Personal Information: We do NOT sell, rent, or share your personal information or personal data with third parties for monetary or other valuable consideration, nor for cross-context behavioral advertising.
• Categories of Data Collected (Past 12 Months): Identifiers (pseudonymous device identifier), Internet activity (ephemeral requests for AI answers), audio/visual data (photos/voice inputs actively provided by you for analysis).
• Your California Rights: You have the right to request access, deletion, and information about data handling practices, and to be free from discrimination for exercising your rights.


9. Children's Privacy (COPPA Compliance)


Our service is not directed to children under the age of 13 (or under 16 in the European Union). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can immediately delete the corresponding data.


10. Contact Us


For any questions, requests, or privacy concerns, please contact our privacy team at: support@nplusb.de